Symantec describes the activities of "Elfin," an Iranian group that's working against targets in Saudi Arabia and the US. Elfin's targets have been drawn largely from the "engineering, chemical, research, energy consultancy, finance, IT, and healthcare sectors." Symantec calls the group agile and active, and notes that it operates by scanning for vulnerable websites against which it deploys a range of commodity and custom-built tools. SecurityWeek notes that FireEye tracks the group as APT33. Neither Symantec nor FireEye think Elfin is the group responsible for the 2018 wave of Shamoon attacks, although Elfin and Shamoon's targets have shown some overlap.

Microsoft yesterday took down a different Iranian APT by seizing ninety-nine websites the group (which Microsoft calls "Phosphorus" and others call "Charming Kitten" or "APT35") used to stage attacks.

Newsweek and others report that a small contingent of Russian troops, two planeloads, arrived in Venezuela with the avowed purpose of assisting the Chavista regime recover from what Caracas maintains is a wave of cyberattacks and sabotage that have crippled its electrical grid. The Russian troops are said to include both special operations forces and cyber operators. Few credit the Maduro regime's hacking allegations, but that's their story and they're sticking to it. As the Military Times observes, the US wants the Russians out, and the Russians say they're staying.

The Wall Street Journal, citing court records and defense counsel's statements, reports that former NSA contractor Hal Martin is today expected to plead guilty to charges involving theft of classified material.